ELMAX STORE a.s. processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation; hereinafter referred to as the “Regulation”), as well as in compliance with relevant national legislation in the field of personal data protection. The personal data processed are those you provide to ELMAX in connection with the purchase of goods or use of services (e.g., when ordering goods in the e-shop or communicating with ELMAX via call center/live chat). These include the following personal data:

1. Identification Data

• Name and surname, username and password, and, in the case of purchases as a business entity, your identification number (IČ) and tax identification number (DIČ)

2. Contact Data

• Phone number, email, and delivery, billing, or other contact address

3. Order Data

• Information about ordered goods and services, payment details, delivery information, and data related to complaints

4. Account Settings Data

• Information about your user account and additional details provided through it (age, gender), data about participation in consumer contests organized by ELMAX, and newsletter settings

5. Website Behavior Data

• In particular, information about the goods and services you view, data about the device you use to browse the website, such as IP address and derived location, device identification, its technical parameters like operating system and its version, browser used and its version, as well as data obtained from cookies and similar technologies for device identification

6. Derived Data

• Personal data obtained through the analysis and processing of other personal data (e.g., purchase preferences)

ELMAX STORE a.s. processes these personal data solely in accordance with the purposes outlined below and to the extent and for the duration necessary to fulfill these specified purposes.

a) Processing of Personal Data in Connection with the Purchase of Goods in the E-Shop

The processing of personal data is necessary for the purposes of concluding a purchase contract and its subsequent execution, delivery of ordered goods, and also for fulfilling legal obligations. In connection with the purchase of goods on ELMAX’s website, your personal data may also be processed with regard to the legitimate interests of ELMAX outlined below.

When creating an order and fulfilling the contractual relationship, ELMAX collects and processes your personal data to the extent of – name, surname, residential or delivery address, phone number, email address, order details, and, in the case of purchases as a business entity, also your identification number (IČ) and tax identification number (DIČ). Providing this personal data is a fundamental prerequisite for concluding or amending a purchase contract, communicating regarding the order, its delivery, or handling any potential complaints, with the primary purpose of clearly and unmistakably identifying you and contacting you for the above-mentioned purposes.

In the case of purchasing goods on ELMAX’s website, ELMAX is obliged to process your identification and contact details and order data to fulfill its legal obligations. These primarily include legal obligations arising from:

• Act No. 89/2012 Coll., Civil Code,
• Act No. 634/1992 Coll., on Consumer Protection,
• Act No. 235/2004 Coll., on Value Added Tax,
• Act No. 563/1991 Coll., on Accounting, and possibly other laws, as well as in connection with inspections by public authorities based on these laws.

ELMAX STORE a.s. further processes your identification and contact details and order data in connection with purchases made in the e-shop based on its legitimate interests, which primarily consist of protecting ELMAX’s legal claims and ensuring proper contract fulfillment and service provision. Additionally, based on legitimate interests, your personal data is processed for the purpose of improving and customizing services, adjusting the e-shop and its offerings, testing new features, and assessing your satisfaction with purchases.

Based on ELMAX’s legitimate interest, you may be contacted with further offers of goods and services, including personalized ones, without your prior consent, unless you have opted out, provided these offers relate to previous purchases made in the e-shop. These offers may be sent via email, phone, or other suitable means.

You have the right to object to this processing carried out based on our legitimate interest.

b) Processing of Personal Data in Connection with Customer Care

This processing of personal data often follows from the processing related to the purchase of goods in the e-shop. If you contact us with a problem, complaint, or claim, we will process your personal data (identification and contact details, order data, and data related to the use of the call center) for the purpose of resolving them, and further based on our legitimate interests to respond to these issues, complaints, or claims, adjust our processes, e-shop, and offered products, and improve our services.

ELMAX also proactively assesses your satisfaction with the provided services through email questionnaires as part of the Verified by Customers program on the Heureka.cz portal and the Zboží.cz program, in which ELMAX participates. We send these to you each time you make a purchase with us, unless you have opted out of receiving our offers. For these purposes, we may share information about purchased goods and your email address with the operators of the Heureka.cz and Zboží.cz portals.

c) Processing of Personal Data in Connection with Maintaining a User Account

If you create an account on ELMAX’s website, we process your identification and contact details, your settings, and order data (if you make purchases with us later) based on the fulfillment of a contract to maintain your user account. The contract on which this processing is based is created by setting up your account. For this purpose, we process personal data for the duration of your account’s existence, which you can delete at any time.

If you have a user account on ELMAX’s website, we may also process your personal data in connection with it based on legitimate interest. On this basis, we may process your identification and contact details, settings data, order data, or website behavior data to improve our services, and you may also be subject to non-personalized offers and advertisements on ELMAX’s website without your prior consent.

d) Processing of Personal Data in Connection with Sending Newsletters

If you register your email address to receive newsletters, ELMAX will process your personal data to the extent of – email address, based on your consent to the processing of personal data for the purpose of sending promotional emails and other commercial communications via electronic means in accordance with Act No. 480/2004 Coll., on Certain Information Society Services. ELMAX will only start processing your personal data after you register your email address for newsletters on ELMAX’s website.

e) Processing of Personal Data in Connection with Visiting ELMAX’s Website

When you visit ELMAX’s website, we store and subsequently read small files such as cookies on your device. Detailed information about cookie processing can be found in the Cookie Policy.

Based on your visit to ELMAX’s website, we may also process other website behavior data based on legitimate interest, where this legitimate interest is the improvement of ELMAX’s services, including creating statistics and reports, testing new features, and preventing attacks on our website and threats to its functionality and the security of your data. Website behavior data may also be used to create personalized offers and advertisements.

f) Processing Based on Your Consent

If you give ELMAX consent to process personal data, your personal data will also be processed for the purposes specified in that consent.

g) Processing of Personal Data in Connection with Participation in Consumer Contests

If you participate in a consumer contest organized by ELMAX, we process your identification and contact details and data provided for the purpose of participating in the contest based on the fulfillment of a contract. The contract on which this processing is based is created by registering for the consumer contest. Any activity or communication with us via social media and the processing of your personal data is governed by the privacy policies of the company operating the respective social network.

Your personal data is primarily processed for the duration of the contractual relationship between you and ELMAX STORE a.s., i.e., for the period during which rights and obligations from this contractual relationship can be exercised, particularly during the limitation period and for a reasonable period thereafter in case any claims are made after the limitation period expires.

We further note that personal data necessary for the proper provision of services or for fulfilling all of ELMAX’s obligations, whether these obligations arise from the contract between us or from generally binding legal regulations, must be processed regardless of your consent for the period specified by the relevant legal regulations or in accordance with them (e.g., for tax documents, this period is at least 10 years pursuant to Section 35 of Act No. 235/2004 Coll., on Value Added Tax).

If personal data is processed for the purpose of sending newsletters based on your subscription to them, this personal data is processed until you unsubscribe your email from receiving these newsletters, either through the link provided in the sent emails or by otherwise withdrawing your consent to receiving newsletters.

Data obtained through a user account or similar means is processed for the duration of the use of our services and typically for 5 years after its cancellation. After the cancellation of a user account, only basic identification data and information about the reason for the account’s cancellation, or data forming part of operational backups, are usually stored for a reasonable period.

Personal data processed based on ELMAX’s legitimate interest is processed for a reasonable period during which our specified legitimate interest persists.

Cookies on the website are processed for the period specified in the Cookie Policy.

If your personal data is processed based on your consent, it is processed for the period specified in that consent or until its withdrawal, whichever occurs first.

a) Transfer of Personal Data in Connection with the Delivery of Goods

To deliver goods to you, ELMAX uses the services of transport companies. Your identification and contact details are transferred to these transport companies.

ELMAX uses the following transport companies:

• Zásilkovna s.r.o., ID No. 28408306
• PPL CZ s.r.o., ID No. 25194798
• General Logistics Systems Czech Republic, s.r.o., ID No. 26087961
• Česká pošta, s.p., ID No. 47114983
• HELICAR a.s., ID No. 25405969

b) ELMAX also uses the services of third parties for processing payments for goods in the e-shop, namely operators of payment systems and payment gateways. These operators are primarily provided with order data.

ELMAX uses the following payment system operators:

• GOPAY s.r.o., ID No. 26046768

c) ELMAX uses third-party services to ensure the highest quality customer care. Based on ELMAX’s legitimate interests, your identification and contact details and order data are transferred to these entities.

These third parties include:

• Heureka Group a.s., ID No. 07822774 (for sending purchase satisfaction questionnaires)
• cz, a.s., ID No. 26168685 (for sending purchase satisfaction questionnaires)
• HubSpot, Inc. (software for customer care)
• Celonis Inc. (via the Make platform, automation of customer care processes)
• Microsoft Corporation (Microsoft 365, tools for data processing and customer communication)
• OpenAI, L.L.C. (artificial intelligence tools for analyzing and improving customer care)

d) ELMAX collaborates with third parties in connection with its marketing activities. Your identification and contact details, order data, and website behavior data may be transferred to these entities.

For marketing purposes, ELMAX uses the services of the following entities:

• HubSpot, Inc. (software for customer care and monitoring customer behavior)
• Google LLC (Google Analytics, Google Tag Manager)
• Hotjar Ltd. (software for monitoring customer behavior)

e) Third parties are also involved in the processing of cookies. Detailed information about this processing is included in the Cookie Policy.

f) In connection with its activities, ELMAX further collaborates and transfers personal data to the following entities for the specified purposes:

• ABRA Software a.s., ID No. 25097563 (accounting software)

In some cases, ELMAX may transfer your personal data to countries outside the European Economic Area in connection with the use of services provided by certain foreign companies (Google, Facebook, HubSpot). ELMAX transfers personal data only to companies that have committed to strictly protecting your personal data, exclusively from the United States. However, we must inform you that the USA is a country that does not provide an adequate level of personal data protection; this implies, among other things, that government agencies in the USA may be authorized to access your personal data without effective remedies being available.

In connection with the processing of personal data, you have certain rights vis-à-vis ELMAX. These rights include:

a) Right of Access

Based on this right, you have the right to know what data is being processed about you, for what purpose, for how long, where your personal data is obtained, to whom it is transferred, who processes it besides ELMAX, and what other rights you have related to the processing of your personal data. Although all this information should be included in this document (or other documents referred to herein), you can contact ELMAX with a request for further information if anything is unclear.

b) Right to Rectification

If you find that the personal data processed by ELMAX about you is inaccurate or incomplete, you have the right to have it corrected or supplemented without undue delay.

c) Right to Erasure

In certain cases, you have the right to have your personal data erased. Your personal data will be erased without undue delay if one of the following reasons applies:

• The personal data is no longer needed for the purposes for which it was processed,
• You withdraw your consent to the processing of personal data, where such consent is necessary for processing, and there is no other reason to continue processing the data,
• You exercise your right to object to processing (see below under Right to Object to Processing) for personal data processed based on ELMAX’s legitimate interests, and it is found that no such legitimate interests justifying the processing exist, or
• You believe that the processing of personal data by ELMAX is no longer in compliance with generally binding regulations.
  This right does not apply if the processing of personal data remains necessary to fulfill ELMAX’s legal obligations or to establish, exercise, or defend legal claims.

d) Right to Restriction of Processing

In some cases, in addition to the right to erasure, you may exercise the right to restrict the processing of personal data. This right allows you to request, in certain cases, that your personal data be marked and not subject to any further processing operations—not permanently (as with the right to erasure), but for a limited period. ELMAX will restrict the processing of personal data if:

• You contest the accuracy of the personal data until it is determined which data is correct,
• Your personal data is processed without sufficient legal grounds (e.g., beyond what is permitted), but you prefer restriction over erasure of such data (e.g., if you expect to provide such data to ELMAX in the future anyway),
• Your personal data is no longer needed for the purposes mentioned above, but you require it to establish, exercise, or defend your legal claims, or
• You object to the processing. The right to object is described in more detail below under Right to Object to Processing. For the period during which it is being investigated whether your objection is justified, ELMAX is obliged to restrict the processing of your personal data.

e) Right to Data Portability

You have the right to obtain from ELMAX all personal data you have provided and which is processed based on your consent. Your personal data will be provided in a structured, commonly used, and machine-readable format. To facilitate the transfer of data at your request, this applies only to data processed automatically in electronic databases.

f) Right to Object to Processing

You have the right to object to the processing of personal data carried out based on ELMAX’s legitimate interest. ELMAX will cease processing the personal data unless there are compelling legitimate grounds to continue such processing. Based on an objection, ELMAX will always cease processing your personal data for direct marketing purposes.

g) Right to Lodge a Complaint

At any time, you may lodge a complaint regarding the processing of your personal data with the supervisory authority, which is the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, email: posta@uoou.cz.

For any inquiries regarding the processing of your personal data or to exercise the above-mentioned rights, you can contact ELMAX in writing at Topolová 777/2, Horní Těrlicko, 735 42 Těrlicko, by phone at +420 599 529 257, or via email at gdpr@elmax.cz.